On 15/08/2026 4:26, Mike Pattrick wrote:
*External email: Use caution opening links or attachments*
On Tue, Aug 11, 2026 at 5:39 AM Eli Britstein <[email protected]> wrote:
When IPF detects an overlapping or duplicate fragment, drop it instead
of marking its CT state invalid and returning it to the conntrack
batch.
This aligns with the Linux kernel, which discards such fragments
during
IP reassembly rather than forwarding them separately.
Assisted-by: composer-2.5-fast, Cursor
Fixes: 4ea96698f667 ("Userspace datapath: Add fragmentation
handling.")
Signed-off-by: Eli Britstein <[email protected]>
---
lib/ipf.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/lib/ipf.c b/lib/ipf.c
index d836b8824..185d6432e 100644
--- a/lib/ipf.c
+++ b/lib/ipf.c
@@ -823,8 +823,8 @@ ipf_is_frag_duped(const struct ipf_frag
*frag_list, int last_inuse_idx,
}
/* Adds a fragment to a list of fragments, if the fragment is not a
- * duplicate. If the fragment is a duplicate, that fragment is marked
- * invalid to avoid the work that conntrack would do to mark the
fragment
+ * duplicate. If the fragment is a duplicate, the fragment is dropped
+ * to avoid the work that conntrack would do to mark the fragment
* as invalid, which it will in all cases. */
static bool
ipf_process_frag(struct ipf *ipf, struct ipf_list *ipf_list,
@@ -852,8 +852,8 @@ ipf_process_frag(struct ipf *ipf, struct
ipf_list *ipf_list,
}
} else {
ipf_count(ipf, v6, IPF_NFRAGS_OVERLAP);
- pkt->md.ct_state = CS_INVALID;
- return false;
+ dp_packet_delete(pkt);
+ return true;
This looks reasonable. However, I think while we're fixing this, we
should also take a second look at ipf_is_frag_duped(), for example,
this function allows a fragment which is a subset of a previous fragment.
That's right, but not in this commit. I'll add another one to handle
this, as well as some other issue too.
-M
}
return true;
}
--
2.43.0
_______________________________________________
dev mailing list
[email protected]
https://mail.openvswitch.org/mailman/listinfo/ovs-dev
